Privacy is an important aspect of digital commerce. However, privacy requirements are often difficult to satisfy when combined with other important properties, such as fair and correct charging for information downloaded or otherwise retrieved over the Internet or other type of network. In order for a merchant to be able to charge a customer or other user correctly for such retrieved information, it generally must know that the user has obtained information exactly corresponding to a particular requested payment. However, in many situations a user may prefer that no one, not even the merchant, know exactly what information he or she is buying. Existing techniques for private information retrieval have been unable to provide an adequate solution to this problem in an efficient manner. Moreover, such techniques have generally been unable to hide from the merchant the particular purchase price associated with a given retrieved information item. This type of approach fails to provide adequate protection of user privacy in that the type of information purchased can often be inferred from the purchase price.
A wide variety of cryptographic techniques are also known in the art. Such techniques include public key cryptography and digital signatures. One well-known type of public key cryptography is based on ElGamal encryption using discrete logarithms, and is described in T. ElGamal, “A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms,” IEEE Transactions on Information Theory, Vol. 31, pp. 469–472, 1985, which is incorporated by reference herein. A well-known type of digital signature referred to as a Schnorr signature is described in C. P. Schnorr, “Efficient Signature Generation for Smart Cards,” Journal of Cryptology 4, pp. 161–174, 1981, which is incorporated by reference herein. It is also known that a signed ElGamal encryption of a message can be generated as an ElGamal ciphertext together with a Schnorr signature of that ciphertext, with the public signature key given by the ElGamal ciphertext. This signed ElGamal encryption is described in greater detail in M. Jakobsson, “A Practical Mix,” Enurocrypt ′98, LNCS 1403, pp. 448–461, 1998, and in U.S. Pat. No. 6,049,613 issued Apr. 11, 2000 and entitled “Method and Apparatus for Encrypting, Decrypting and Providing Privacy for Data Values,” both of which are incorporated by reference herein.
Although these and other cryptographic techniques are known in the art, such techniques have not heretofore been applied to private information retrieval in a manner which solves the above-noted problem of preventing a merchant from determining the particular information items purchased by a given user.